GAO found that NASA has improved its FMFIA implementation, but: (1) used a questionable process to identify internal control weaknesses and failed to identify some material weaknesses; (2) did little to change its follow-up process for identified weaknesses; (3) cannot ensure that certain key internal controls are working as intended; and (4) was unable to effectively use its vulnerability assessments because they did not identify the areas of highest risk. GAO also found that, while NASA has made progress in evaluating its accounting systems, it: (1) failed to evaluate 8 of the 20 systems in its accounting system inventory; (2) did not sufficiently test the systems it did evaluate; and (3) did not have an adequate basis to report that its systems were in conformance with the Comptroller General's requirements for accounting systems.

Recommendations for Executive Action

Status: Closed - Not Implemented

Comments: NASA conducted detailed evaluations at 4 of 9 locations during 1986, including testing transactions, and plans to review all systems at least once every 2 years. Despite reporting all of the 17 systems in conformance, NASA is developing a new agencywide personnel payroll system to replace 13 operating systems. The system is planned to be in operation by September 1988.

Recommendation: The Administrator, NASA, should limit the accounting systems conformance statement to only those systems which have been evaluated and properly tested in operation during the NASA 2-year accounting system evaluation cycle.

Agency Affected: National Aeronautics and Space Administration

Status: Closed - Not Implemented

Comments: NASA has taken action to comply with OMB Circular A-130 and has recognized a material weakness in its computer controls. Corrective actions are planned, including cyclical risk assessments, which should address GAO primary concerns.

Recommendation: The Administrator, NASA, should direct the Associate Administrator for Management to ensure that NASA managers are provided sufficient guidance to allow them to comprehensively evaluate automatic data processing (ADP) internal controls.

Agency Affected: National Aeronautics and Space Administration

Status: Closed - Not Implemented

Comments: NASA reported 11 material control weaknesses in 1986 and has taken well documented action to address hundreds of specific recommendations contained in the Rogers Commission Report. While these major organization and procedural changes are being implemented, GAO will defer this specific recommendation.

Recommendation: The Administrator, NASA, should direct the Associate Administrator for Management to ensure that NASA centers are reporting all important internal control weaknesses to the Internal Control Working Group.

Agency Affected: National Aeronautics and Space Administration

Status: Closed - Not Implemented

Comments: The NASA FMFIA program is in accordance with new Office of Management and Budget (OMB) guidelines and provides an adequate basis for stating that its internal control systems met FMFIA requirements.

Recommendation: The Administrator, NASA, should not report that systems of internal control, taken as a whole, meet the requirements of the act until the Administrator is ensured that the FMFIA program provides an adequate basis to make such a determination.

Agency Affected: National Aeronautics and Space Administration

Status: Closed - Not Implemented

Comments: NASA reported that detailed evaluations have included tests of transactions and that the reviews are in accordance with the new OMB Circular A-127. NASA plans to review all of its systems every 2 years.

Recommendation: The Administrator, NASA, should direct the Comptroller to ensure that transaction tests are performed on all critical aspects of accounting systems in operation, including ADP controls.